v0.0.9.3

README.md

@@ -155,7 +155,7 @@ preserved.
 | Subspaces Prover | 8888 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `subs-prover` RISC Zero prover server (no GPU). Its own StartOS interface. Only useful while Subspaces is enabled. |
 | Subspaces Registry | 8081 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `registry-server` for publishing/resolving handles (remapped from its upstream default 8080 to avoid colliding with the gotty terminal on 8080). Its own StartOS interface. Only useful while Subspaces is enabled. |
 | Certrelay | 7778 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `certrelay` server (always on). Serves cryptographic proofs binding handles to owner keys. **Setup:** run **Configure Certrelay** and set `CERTRELAY_SELF_URL` to the publicly visible URL StartOS exposes for this interface. |
-| Spaced RPC | 7225 | HTTP JSON-RPC | **Loopback only** | Internal use, static-cred-authenticated via `SPACED_RPC_USER` / `SPACED_RPC_PASSWORD` from `store.json.spacedAuth` |
+| Spaces API (spaced RPC) | 7225 | HTTP JSON-RPC | LAN / `.local` / Tor / clearnet (via StartOS) | spaced JSON-RPC, now bound to `0.0.0.0` and exposed as the **Spaces API** interface. Static-cred-authenticated via `SPACED_RPC_USER` / `SPACED_RPC_PASSWORD` from `store.json.spacedAuth`. Internal clients still connect over loopback. |
 | PostgreSQL | 5432 | Postgres wire protocol | **Loopback only** (`listen_addresses=127.0.0.1`) | Username/password from `store.json.dbAuth`; full `DB_URL` exported into the web terminal |
 
 ## Actions
@@ -194,7 +194,7 @@ the same idempotent init logic runs and reuses the existing credentials in
 | ID | Display | Grace period | Behaviour |
 | --- | --- | --- | --- |
 | `postgres` (daemon `ready`) | Database | 60 s | TCP listen on `127.0.0.1:5432` |
-| `spaced` (daemon `ready`) | Spaced RPC | 120 s | TCP listen on `127.0.0.1:7225` |
+| `spaced` (daemon `ready`) | Spaced RPC | 120 s | TCP listen on `0.0.0.0:7225` (exposed as the Spaces API interface) |
 | `subs-prover` (daemon `ready`) | Subspaces Prover | 60 s | TCP listen on `0.0.0.0:8888`. Only present when Subspaces **and** the `set-subs-prover` toggle are enabled (toggle defaults off). Polled every 30 s; nothing depends on it. |
 | `subs-registry` (daemon `ready`) | Subspaces Registry | 60 s | TCP listen on `0.0.0.0:8081`. Only present when Subspaces is enabled. |
 | `subs` (daemon `ready`) | Subspaces Web UI | 60 s | TCP listen on `0.0.0.0:7777`. Only present when Subspaces is enabled. |
@@ -211,12 +211,13 @@ the same idempotent init logic runs and reuses the existing credentials in
 3. **Space-CLI Web UI is a terminal, not a graphical app.** All Spaces operations happen
    via `space-cli` (aliased as `spaces` inside the shell).
 4. **Externally exposed ports** (each a StartOS interface): 8080 (gotty
-   Space-CLI Web UI, always on), 7778 (Certrelay, always on), and — only while
-   their feature is enabled — 3000 (Explorer Web UI, currently stubbed), 7777
-   (Subspaces Web UI), 8888 (Subspaces Prover), 8081 (Subspaces Registry).
-   **Loopback-only:** spaced RPC (7225) and PostgreSQL (5432). The Subspaces
-   registry is remapped from its upstream default 8080 to 8081 to avoid
-   colliding with the gotty terminal.
+   Space-CLI Web UI, always on), 7225 (Spaces API / spaced RPC, always on),
+   7778 (Certrelay, always on), and — only while their feature is enabled —
+   3000 (Explorer Web UI, currently stubbed), 7777 (Subspaces Web UI), 8888
+   (Subspaces Prover), 8081 (Subspaces Registry). **Loopback-only:** PostgreSQL
+   (5432). The spaced RPC is authenticated (static creds) even though it's now
+   externally exposed. The Subspaces registry is remapped from its upstream
+   default 8080 to 8081 to avoid colliding with the gotty terminal.
 5. **Bitcoin Core 31.x is the only supported dependency.** Earlier majors are
    not allowed by the manifest version range.
 6. **The web terminal is independent of spaced.** Gotty stays reachable even
@@ -308,7 +309,7 @@ ports:
   subspaces_prover: 8888  # external (its own interface), subspaces only
   subspaces_registry: 8081  # external (its own interface), subspaces only; remapped from upstream 8080
   certrelay: 7778       # external (its own interface), always on
-  spaced_rpc: 7225      # loopback only
+  spaced_rpc: 7225      # external (Spaces API interface); spaced binds 0.0.0.0, auth-gated
   postgres: 5432        # loopback only
 dependencies:
   - bitcoind